@@ -2486,16 +2486,17 @@ long long simplecpp::characterLiteralToLL(const std::string& str)
 
             if (!narrow && value >= 0x80) {
                 // Assuming this is a UTF-8 encoded code point.
-                // This decoder does not completely validate the input, for example it doesn't reject overlong encodings.
+                // This decoder may not completely validate the input.
+                // Noncharacters are neither rejected nor replaced.
 
                 int additional_bytes;
-                if (value >= 0xf8)
+                if (value >= 0xf5)  // higher values would result in code points above 0x10ffff
                     throw std::runtime_error("assumed UTF-8 encoded source, but sequence is invalid");
                 else if (value >= 0xf0)
                     additional_bytes = 3;
                 else if (value >= 0xe0)
                     additional_bytes = 2;
-                else if (value >= 0xc0)
+                else if (value >= 0xc2) // 0xc0 and 0xc1 are always overlong 2-bytes encodings
                     additional_bytes = 1;
                 else
                     throw std::runtime_error("assumed UTF-8 encoded source, but sequence is invalid");
@@ -2505,9 +2506,14 @@ long long simplecpp::characterLiteralToLL(const std::string& str)
                 while (additional_bytes--) {
                     if(pos + 1 >= str.size())
                         throw std::runtime_error("assumed UTF-8 encoded source, but character literal ends unexpectedly");
+                    
                     unsigned char c = str[pos++];
-                    if((c >> 6) != 2) // ensure c has form 0xb10xxxxxx
+                    
+                    if (((c >> 6) != 2)    // ensure c has form 0xb10xxxxxx
+                        || (!value && additional_bytes == 1 && c < 0xa0)    // overlong 3-bytes encoding
+                        || (!value && additional_bytes == 2 && c < 0x90))   // overlong 4-bytes encoding
                         throw std::runtime_error("assumed UTF-8 encoded source, but sequence is invalid");
+                    
                     value = (value << 6) | (c & ((1 << 7) - 1));
                 }
 
 
@@ -263,6 +263,8 @@ static void characterLiteral()
     ASSERT_EQUALS('\x89', simplecpp::characterLiteralToLL("'\x89'"));
     ASSERT_THROW(simplecpp::characterLiteralToLL("U'\x89'"), std::runtime_error);
 
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xf4\x90\x80\x80'"), std::runtime_error);
+
     // following examples based on https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-test.txt
     ASSERT_EQUALS(0x80, simplecpp::characterLiteralToLL("U'\xc2\x80'"));
     ASSERT_EQUALS(0x800, simplecpp::characterLiteralToLL("U'\xe0\xa0\x80'"));
@@ -296,6 +298,19 @@ static void characterLiteral()
 
     ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xf8'"), std::runtime_error);
     ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xff'"), std::runtime_error);
+    
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xc0\xaf'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xe0\x80\xaf'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xf0\x80\x80\xaf'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xc1\xbf'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xe0\x9f\xbf'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xf0\x8f\xbf\xbf'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xc0\x80'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xe0\x80\x80'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xf0\x80\x80\x80'"), std::runtime_error);
+
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xed\xa0\x80'"), std::runtime_error);
+    ASSERT_THROW(simplecpp::characterLiteralToLL("U'\xed\xbf\xbf'"), std::runtime_error);
 }
 
 static void combineOperators_floatliteral()